Splunk Search

Multiple WHERE's in Query

inovexsean
Explorer

I'm trying to write an ANTLR grammar for Splunk queries and an example of the queries that my system receives is as follows :

...|append[|tstats count where (index=accm_*) earliest=1d@d latest=now where (index=accm_*) siteId="my_site",selectors{}.categories{}=* by selectors{}.categories{}|...

I do not see in the documentation how the previous statement could have where specified twice. Could someone please explain this to me?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

That is not valid syntax. Replace the second where with AND.

View solution in original post

woodcock
Esteemed Legend

That is not valid syntax. Replace the second where with AND.

inovexsean
Explorer

Thanks. That was my suspicion, but I'm not familiar enough with the QL to be certain. The queries are written by other people and we're just auditing them.

0 Karma

FrankVl
Ultra Champion

Not entirely sure what your on about either, but that second where doesn't make any sense there, same for the , after siteId="my_site".

0 Karma

woodcock
Esteemed Legend

Um ... .... ....... ? Please rephrase with 500% more text at a minimum.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...